CVE-2026-110619 frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
Unauthenticated attackers can access pprof debug endpoints in frp to leak sensitive runtime data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110619?
CVE-2026-110619 is a medium-severity missing authorization vulnerability in fatedier frp, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
Weakness: CWE-306
Which versions are affected by CVE-2026-110619?
How do I fix CVE-2026-110619?
No fix has been published for CVE-2026-110619 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-110619 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110619 exists.
Sources
Also known as GHSA-8584-2qgx-4xpf.